How to start with STM32CubeMX STiRoT Boot path on STM32H57S

Target description

The purpose of this article is to provide step-by-step instructions on how to configure a boot path.
The example below demonstrates how to configure and provision a boot path for an STiRoT (ST immutable Root of Trust) and generate an application code using CubeMx.
The initially generated code is modified to blink the green led embedded on the board.

Read Secure Boot STM32H7RS How to Introduction before starting the practical example described below.

For more technical details which may be useful to know before getting started, check out the following articles:

• Security features on STM32H7RS
• STiRoT for STM32H7S

The figure below shows the possible bootpaths for the STM32H7RS.
The STiRoT is only supported for the STM32H7S, since it requires the Cryp hardware accelerator not supported on the STM32H7R.

The example described in this article uses the boot path indicated in bellows figure.

File:H7RS boot paths.png

Figure1 STM32H7RS boot paths

Prerequisites
To execute the example described below, you need an STM32H57S-DK discovery board:

Figure 2 STM32H7S DK MB1736

You'll also need the following tools:

• STM32CubeMX_6.11.0 or later
• IAR Embedded Workbench rev 9.20.1 or later
• STM32CubeProgrammer rev 2.16.0

Note:

• STM32 Trusted Package Creator (TPC) is automatically installed during the STM32CubeMX installation. This TPC version is dedicated to STM32CubeMX and installed in the STM32CubeMX/utilities folder.
• The latest STM32Cube_FW revision is installed through STM32CubeMX (see appendix).

1. Setting up the STM32CubeMX project

Launch STM32CubeMX

1. Click on Access to MCU Selector (for this example, it's easier to enable only the necessary single GPIO, so it's advised to use the MCU selector instead of the board selector).
2. From the Series column, select STM32H7, and select the device used in STM32H7S78-DK.
3. Click start project.
4. For the Memory Protection Unit, select No

Figure 3: STM32CubeMX project start

Create the STM32CubeMX project:

1. Type the name of the project (if it doesn't already exist, the related folder will be created).
2. Choose a folder for the project (avoid a long path).
3. Check that both the Secure Project and Nonsecure Project checkboxes are checked (they should be checked by default).
4. Select the relevant toolchain; for this example EWARM is used.
5. Go to File > Save Project. The project folder (if it doesn't already exist) and the STM32H5_STiROT_SLed_NSLed.ioc file will be created.

Figure 4: STM32CubeMX project configuration